@holo-js/media 0.1.5 → 0.1.6

package/dist/index.mjs

@@ -365,8 +365,10 @@ var Media = defineModel(mediaTable, {
 });
 
 // src/model/adder.ts
-import { basename as basename2 } from "path";
-import { readFile } from "fs/promises";
+import { isIP } from "net";
+import { tmpdir } from "os";
+import { basename as basename2, resolve, sep } from "path";
+import { readFile, realpath } from "fs/promises";
 import { randomUUID } from "crypto";
 import { Storage as Storage3 } from "@holo-js/storage/runtime";
 import { connectionAsyncContext as connectionAsyncContext4 } from "@holo-js/db";
@@ -887,6 +889,11 @@ var MediaItem = class {
 };
 
 // src/model/adder.ts
+var DEFAULT_REMOTE_MEDIA_MAX_SIZE = 10 * 1024 * 1024;
+var LOCAL_MEDIA_SOURCE_ROOTS = Object.freeze([
+  tmpdir(),
+  resolve(process.cwd(), "storage")
+]);
 var MediaAddValidationException = class extends Error {
   error;
   constructor(details) {
@@ -958,8 +965,13 @@ function createMaxSizeError(fileName, collectionName, maxSize, actualSize) {
   });
 }
 async function readRemoteMediaContents(response, fileName, maxSize, collectionName) {
-  if (typeof maxSize !== "number" || !response.body) {
-    return new Uint8Array(await response.arrayBuffer());
+  const resolvedMaxSize = typeof maxSize === "number" ? maxSize : DEFAULT_REMOTE_MEDIA_MAX_SIZE;
+  if (!response.body) {
+    const contents2 = new Uint8Array(await response.arrayBuffer());
+    if (contents2.byteLength > resolvedMaxSize) {
+      throw createMaxSizeError(fileName, collectionName ?? "default", resolvedMaxSize, contents2.byteLength);
+    }
+    return contents2;
   }
   const reader = response.body.getReader();
   const chunks = [];
@@ -974,9 +986,9 @@ async function readRemoteMediaContents(response, fileName, maxSize, collectionNa
         continue;
       }
       totalSize += value.byteLength;
-      if (totalSize > maxSize) {
+      if (totalSize > resolvedMaxSize) {
         await reader.cancel().catch(() => void 0);
-        throw createMaxSizeError(fileName, collectionName ?? "default", maxSize, totalSize);
+        throw createMaxSizeError(fileName, collectionName ?? "default", resolvedMaxSize, totalSize);
       }
       chunks.push(value);
     }
@@ -1011,7 +1023,7 @@ async function resolveMediaSource(input, overrideFileName, overrideName, options
     );
   }
   if (typeof input === "string" || isPathInput(input)) {
-    const path = typeof input === "string" ? input : input.path;
+    const path = await resolveLocalMediaSourcePath(typeof input === "string" ? input : input.path);
     const contents2 = await readFile(path);
     const fileName2 = sanitizeFileName(overrideFileName ?? basename2(path));
     return {
@@ -1061,20 +1073,27 @@ function isUrlInput(input) {
   return typeof input === "object" && input !== null && "url" in input;
 }
 async function resolveRemoteMediaSource(input, overrideFileName, overrideName, maxSize, collectionName) {
-  const response = await fetch(input.url);
+  const remoteUrl = resolveRemoteMediaUrl(input.url);
+  const response = await fetch(remoteUrl, {
+    redirect: "manual"
+  });
+  if (response.status >= 300 && response.status < 400) {
+    throw new Error("[@holo-js/media] Remote media downloads do not follow redirects.");
+  }
   if (!response.ok) {
     throw new Error(
-      `[Holo Media] Failed to download media from "${input.url}" (${response.status} ${response.statusText}).`
+      `[Holo Media] Failed to download media from "${remoteUrl}" (${response.status} ${response.statusText}).`
     );
   }
   const fileName = sanitizeFileName(
-    overrideFileName ?? input.fileName ?? parseRemoteFileName(input.url)
+    overrideFileName ?? input.fileName ?? parseRemoteFileName(remoteUrl)
   );
   const responseMimeType = response.headers.get("content-type")?.split(";")[0];
   const contentLengthHeader = response.headers.get("content-length");
   const contentLength = contentLengthHeader?.trim() ? Number(contentLengthHeader) : Number.NaN;
-  if (typeof maxSize === "number" && Number.isFinite(contentLength) && contentLength > maxSize) {
-    throw createMaxSizeError(fileName, collectionName ?? "default", maxSize, contentLength);
+  const resolvedMaxSize = typeof maxSize === "number" ? maxSize : DEFAULT_REMOTE_MEDIA_MAX_SIZE;
+  if (Number.isFinite(contentLength) && contentLength > resolvedMaxSize) {
+    throw createMaxSizeError(fileName, collectionName ?? "default", resolvedMaxSize, contentLength);
   }
   const contents = await readRemoteMediaContents(
     response,
@@ -1091,6 +1110,50 @@ async function resolveRemoteMediaSource(input, overrideFileName, overrideName, m
     name: getDisplayName(fileName, overrideName ?? input.name)
   };
 }
+async function resolveLocalMediaSourcePath(path) {
+  const resolvedPath = await realpath(path);
+  const allowedRoots = await Promise.all(LOCAL_MEDIA_SOURCE_ROOTS.map(async (root) => await realpath(root).catch(() => null)));
+  if (allowedRoots.some((root) => root && isPathWithinRoot(resolvedPath, root))) {
+    return resolvedPath;
+  }
+  throw new Error("[@holo-js/media] Media path sources must resolve inside an allowed upload directory.");
+}
+function isPathWithinRoot(path, root) {
+  return path === root || path.startsWith(`${root}${sep}`);
+}
+function resolveRemoteMediaUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("[@holo-js/media] Remote media URLs must be valid absolute URLs.");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("[@holo-js/media] Remote media URLs must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("[@holo-js/media] Remote media URLs must not include credentials.");
+  }
+  if (isBlockedRemoteMediaHost(url.hostname)) {
+    throw new Error("[@holo-js/media] Remote media URLs must not target local or private hosts.");
+  }
+  return url.toString();
+}
+function isBlockedRemoteMediaHost(hostname) {
+  const normalized = hostname.toLowerCase();
+  if (normalized === "localhost" || normalized.endsWith(".localhost")) {
+    return true;
+  }
+  const ipVersion = isIP(normalized);
+  if (ipVersion === 4) {
+    const [first = 0, second = 0] = normalized.split(".").map(Number);
+    return first === 0 || first === 10 || first === 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first >= 224;
+  }
+  if (ipVersion === 6) {
+    return normalized === "::1" || normalized === "::" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe80:");
+  }
+  return false;
+}
 function validateSource(collection2, source) {
   if (typeof collection2.maxSize === "number" && source.size > collection2.maxSize) {
     throw createMaxSizeError(source.fileName, collection2.name, collection2.maxSize, source.size);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/media",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Holo-JS Framework - media collections and conversions for Holo-JS models",
   "type": "module",
   "license": "MIT",
@@ -22,9 +22,9 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/db": "^0.1.5",
-    "@holo-js/queue": "^0.1.5",
-    "@holo-js/storage": "^0.1.5",
+    "@holo-js/db": "^0.1.6",
+    "@holo-js/queue": "^0.1.6",
+    "@holo-js/storage": "^0.1.6",
     "sharp": "^0.34.4"
   },
   "devDependencies": {